Project 48: Shodan Recon for Defenders

Module: Module 5: Password Attacks, Network Defense & Vulnerability Management  |  Level: Intermediate  | 
Primary tool: Shodan (free tier)  |  Estimated time: 75–120 minutes

Objective: See what Shodan already knows about infrastructure you’re responsible for.

Free lab environment

OSINT Framework + theHarvester + Shodan (free tier) — https://osintframework.com/ and https://www.shodan.io/

Practice OSINT techniques against your own domain, your own social media presence, or explicitly-designed OSINT training targets (e.g. TryHackMe’s free OSINT rooms). Shodan’s free tier gives limited but real query results without payment. Never aggregate data on a real private individual without their consent as a course exercise.

Lab workflow

1. Confirm your target is a domain/account you own, or an explicitly-provided training target — never aggregate data about a real private individual without consent as a course exercise.
2. Using Shodan (free tier), run your collection step to see what Shodan already knows about infrastructure you’re responsible for.
3. Organize every raw finding into a simple table: what was found, where, and why it matters.
4. Rank your findings by real-world sensitivity — not every piece of public information is equally risky if combined with other data.
5. Write a one-paragraph remediation note for the single most sensitive finding.
6. Capture the screenshots specified below as your evidence trail.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your Shodan search result for an asset you own
• your written remediation plan for anything exposed that shouldn’t be internet-facing

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.